Lab: Information disclosure in version control history

1. Open the lab and browse to /.git to reveal the lab's Git version control data.

2. Download a copy of this entire directory. For Linux users, the easiest way to do this is using the command:

   wget -r https://YOUR-LAB-ID.web-security-academy.net/.git/

   Windows users will need to find an alternative method, or install a UNIX-like environment, such as Cygwin, in order to use this command.

3. Explore the downloaded directory using your local Git installation. Notice that there is a commit with the message "Remove admin password from config".
4. Look closer at the diff for the changed admin.conf file. Notice that the commit replaced the hard-coded admin password with an environment variable ADMIN_PASSWORD instead. However, the hard-coded password is still clearly visible in the diff.
5. Go back to the lab and log in to the administrator account using the leaked password.
6. To solve the lab, open the admin interface and delete Carlos's account.

Michael Sommer